CVE-2026-93352

Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden_extensions blocklist in config/mediable.php. The blocklist introduced to address CVE-2026-49972 includes phpt but omits pht, which Apache executes as PHP via the default FilesMatch directive on Debian and Ubuntu systems. An attacker can upload a .pht file that passes all validation in MediaUploader::verifyExtension() and File::sanitizeFileName() because pht is not present in the blocklist, causing the file to be written to disk and executed as PHP when requested, enabling remote code execution with the privileges of the web server process.

• CWE-434

• https://github.com/plank/laravel-mediable/commit/8ddb0e5b300084e91ad2cb18a6e7bc768bb7b008
• https://github.com/plank/laravel-mediable/pull/396
• https://github.com/plank/laravel-mediable/releases/tag/7.0.2
• https://www.vulncheck.com/advisories/laravel-mediable-rce-via-pht-file-upload

Published

Sep 23, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93345MikroTik RouterOS before 7.25beta4 contains an improper inpu…7.5
• CVE-2026-93346Wazuh from 4.0.0 before 4.14.8 contains a race condition in …5.3
• CVE-2026-93347Wazuh from 4.1.1 before 4.14.8 contains a path traversal vul…4.9
• CVE-2026-93348Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implement…8.1
• CVE-2026-93349Frictionless before 5.19.1 contains an OS command injection …8.8
• CVE-2026-9335A vulnerability in keras-team/keras versions <= 3.14.0 allow…6.5
• CVE-2026-93353copyparty contains a volume restriction bypass vulnerability…3.1
• CVE-2026-93354Taskview Community before 1.56.0 contains a missing authenti…8.1
• CVE-2026-93355LiteLLM contains a weak authentication vulnerability that al…8.1
• CVE-2026-9336IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …7.5
• CVE-2026-93363The @payloadcms/storage-vercel-blob storage adapter for Payl…4.3
• CVE-2026-93364Bludit CMS through 3.22.0 contains a mass assignment vulnera…4.3